Turns out there is already a class 1 SHA-2 intermediate! It's just buried on their site, but you can add it to your chain and it passes SSLLabs validation and o

Turns out there is already a class 1 SHA-2 intermediate! It's just buried on their site, but you can add it to your chain and it passes SSLLabs validation and otherwise looks totally fine. So this isn't as huge a problem as I had thought. https://www.startssl.com/certs/class1/sha2/pem/sub.class1.server.sha2.ca.pem https://www.startssl.com/certs/class1/sha2/pem/sub.class1.se...